CVE-2013-1164: High severity cisco ios xe software vulnerability

Published Apr 11, 2013

Updated

Cisco IOS XE 3.4 before 3.4.4S, 3.5, and 3.6 on 1000 series Aggregation Services Routers (ASR) does not properly implement the Cisco Multicast Leaf Recycle Elimination (MLRE) feature, which allows remote attackers to cause a denial of service (card reload) via fragmented IPv6 multicast packets, aka Bug ID CSCtz97563.

Affected Software

13 affected components

Cisco IOS XE=3.4.0as

Cisco IOS XE=3.4.0s

Cisco IOS XE=3.4.1s

Cisco IOS XE=3.4.2s

Cisco IOS XE=3.4.3s

Cisco IOS XE=3.5.0s

Cisco IOS XE=3.6.0s

Cisco Asr 1001

Cisco Asr 1002

Cisco Asr 1002-x

Cisco Asr 1004

Cisco Asr 1006

Cisco Asr 1013

Event History

Apr 11, 2013

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-1164?

CVE-2013-1164 has a severity rating of medium, primarily due to its potential to cause a denial of service.

How do I fix CVE-2013-1164?

To mitigate CVE-2013-1164, it is recommended to upgrade to Cisco IOS XE versions 3.4.4S, 3.5, or 3.6 or later.

What devices are affected by CVE-2013-1164?

CVE-2013-1164 affects Cisco ASR 1000 series routers running affected versions of Cisco IOS XE.

What type of vulnerability is CVE-2013-1164?

CVE-2013-1164 is a denial of service vulnerability related to the improper handling of fragmented IPv6 multicast packets.

Can CVE-2013-1164 be exploited remotely?

Yes, CVE-2013-1164 can be exploited remotely by attackers to trigger a card reload on affected devices.